Subsequent efforts to address the drawbacks of Wiesner's scheme led to the idea of public-key quantum money. The first formal treatment of public-key quantum money was given by Aaronson [1]}. Intuitively, in such a scheme, a banknote can be verified by everyone, using a publicly known algorithm, but cannot be copied by anyone. The first explicit construction of public-key quantum money, which was based on stabilizer states, was given in [1]}. The construction was later proved to be insecure by Lutomirski et al. [3]}.
